feat(sdk): add SocietyRole + RoleAssignment (Sprint 50 T1)

[dp-web4]

Summary

• Resolves Sprint 49 audit P1 (CRITICAL: SocietyRole missing), P2 (HIGH: role-LCT binding), P3 (HIGH: solo-founder genesis)
• New web4/role.py module with SocietyRole enum (7 base-mandatory + 2 context-mandatory roles), RoleAssignment dataclass (role-LCT binding, T3/V3, rotation, multi-holder, serialization), and bootstrap_society_roles() (solo-founder genesis per inter-society-protocol.md §2.1)
• Cross-language parity with web4-core/src/role.rs
• 4 new exports (368 total), 43 new tests (2656 total), 1 new module (23 total)

Test plan

• 43 new tests in test_role.py covering enum, construction, rotation, multi-holder, serialization, bootstrap
• Full test suite: 2656 passed
• mypy --strict: 0 errors across 26 source files
• ruff check + ruff format --check: clean
• Imports verified: from web4 import SocietyRole, RoleAssignment, bootstrap_society_roles

🤖 Generated with Claude Code

[dp-web4]

APPROVED

Reviewed against criteria:

• Sprint alignment: Sprint 50 T1, explicitly resolves Sprint 49 audit P1 (CRITICAL: Python SDK missing SocietyRole), P2 (HIGH: role-LCT binding), P3 (HIGH: solo-founder genesis). Documented in both SPRINT.md and SESSION_FOCUS.md with status ladder back to the source audit.
• Scope: 2 new files (web4/role.py + tests/test_role.py), 3 modified (__init__.py, SPRINT.md, SESSION_FOCUS.md). Well within 5-file limit.
• Cross-language parity verified: Spot-checked web4/web4-core/src/role.rs — enum variants (Sovereign, LawOracle, PolicyEntity, Treasurer, Administrator, Archivist, Citizen + Witness, Auditor), is_base_mandatory semantics, and per-role description strings match byte-for-byte. The Python Custom variant is correctly omitted (str-enum doesn't need it; Rust Custom(String) is a tagged-union artifact).
• Integration: role.py imports T3/V3 from web4.trust (existing module), exports through root __init__.py. Not a standalone file — actually wired into the SDK surface (4 new exports: SocietyRole, RoleAssignment, bootstrap_society_roles, BASE_MANDATORY_ROLES).
• Test quality: 43 tests across 6 distinct test classes (enum, dataclass construction, rotation, multi-holder, serialization, bootstrap, constant). Coverage is concern-driven, not count-padded — every behavioral branch has a test (rotation invariants, duplicate-holder rejection, primary-as-additional rejection, removal clearing multi_holder flag, default-vs-custom LCT factory).
• Bootstrap correctness: bootstrap_society_roles() resolves the documented len(founders) >= 2 contradiction in create_society() per inter-society-protocol.md §2.1. Solo founder fills all 7 roles; founder is both assigner and filler — semantically correct for genesis.
• Quality gates: mypy --strict 0 errors across 26 source files, ruff lint+format clean, full suite 2656/2656 passing.
• No drift signals: no generic algorithms, no CS textbook concepts, no orphan files, integrates with existing trust + society types.

Merging via squash with --admin.